The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill's setup instructions direct the user to install the higgsfield CLI by downloading a script from the author's GitHub repository and piping it directly to the shell (curl -fsSL https://raw.githubusercontent.com/higgsfield-ai/cli/main/install.sh | sh). While this originates from the vendor's organization, it is a remote execution pattern.
[COMMAND_EXECUTION]: The skill uses the Bash tool to perform all operations, including media generation, model inspection, and product fetching via the higgsfield CLI.
[CREDENTIALS_UNSAFE]: The skill explicitly uses higgsfield auth login, which manages API credentials on the user's local system to authenticate requests to the Higgsfield platform.
[DATA_EXFILTRATION]: The workflow involves the higgsfield upload create command, which transmits local image, video, and audio files to the vendor's cloud infrastructure for processing.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to the way it processes external data.
Ingestion points: Untrusted data enters the context via the --url flag in higgsfield marketing-studio products fetch (SKILL.md) and through user-provided prompt strings.
Boundary markers: There are no explicit boundary markers or instructions to ignore embedded commands within the fetched URL content or prompt strings.
Capability inventory: The skill possesses Bash execution capabilities to run CLI commands across all referenced workflows.
Sanitization: No sanitization or validation of the fetched content or interpolated prompt strings is described in the provided files.

higgsfield-generate